Security vulnerability in NaCl on x86-32

[Cliff L. Biffle]

We have found a vulnerability in Native Client for x86-32. The hole
has been present in all releases of Native Client since August. It
may allow untrusted code to jump to arbitrary locations within its
code segment, effectively subverting the validator's notion of the
instruction stream.

Because official Native Client releases only allow execution of code
served from localhost, we do not expect this vulnerability to cause
problems in the wild. We have fixed it for the next Native Client
release. However, if any users have disabled or worked around the
localhost restriction, they should update past r1313 and recompile.

This does not affect ARM.

More details and a brief postmortem here:
http://code.google.com/p/nativeclient/issues/detail?id=245

--
Cliff L. Biffle
Native Client Team
Google, Inc.